The plugin registers purely through osTicket's Signal system and makes no core modifications:
bootstrap(), the plugin calls Signal::connect('api', ...) — this works with both the standard API and the API Key Wildcard pluginExtendedTicketApiController extends osTicket's own TicketApiController with the additional parameters and endpointsSubticketApiController encapsulates the subticket endpoints as a separate controllerapi-endpoints/
├── api/ # Endpoint entry points
│ ├── tickets-get.php
│ ├── tickets-update.php
│ ├── tickets-delete.php
│ ├── tickets-search.php
│ ├── tickets-stats.php
│ ├── tickets-statuses.php
│ ├── tickets-attachment-download.php
│ └── tickets-subtickets-*.php
├── assets/ # Admin UI JavaScript/CSS
├── controllers/
│ ├── ExtendedTicketApiController.php
│ └── SubticketApiController.php
├── lib/
│ ├── ApiBootstrap.php
│ ├── Enums/
│ └── Services/
├── tests/ # PHPUnit tests
├── docs/
├── class.ApiEndpointsPlugin.php # Main plugin class
├── config.php # ApiEndpointsConfig
├── plugin.php # Plugin manifest
├── htaccess.template # Template for /api/.htaccess
└── openapi.yaml # OpenAPI specification
The extra permission checkboxes on the API key management page don't come from osTicket core — the plugin injects them itself:
injectAdminUi() injects a JavaScript snippet on requests to /scp/apikeys.php that adds the extra permission fields (can_create_tickets, can_read_tickets, etc.) into the existing formhandleApiKeyFormSubmission() picks up those fields and saves them to the database when the API key form is submittedThis keeps the osTicket core UI untouched while still showing the additional options.
file_id is actually linked in ost_ticket_attachment. Arbitrary file IDs from ost_file (e.g. logos, canned responses, knowledgebase files) are rejected with 403All GET endpoints support both JSON (.json) and XML (.xml) via the URL's file extension. XML output is handled by lib/XmlHelper.php.
The plugin is tested with PHPUnit (composer test). Validation logic deliberately lives in the controllers rather than the API entry points, so it can be tested in isolation.